PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security engineer wants to ensure that no IAM keys are created for service accounts in a Google Cloud organization. Which organization policy constraint should be applied?
⚠ Common exam trap
The PCSE exam often tests the distinction between constraints that control IAM policy membership (Option C) versus those that control service account key creation (Option D), leading candidates to confuse domain restrictions with key management policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
constraints/iam.disableServiceAccountKeyCreation
The `constraints/iam.disableServiceAccountKeyCreation` organization policy constraint specifically prevents the creation of IAM keys for service accounts, which is exactly what the security engineer needs to enforce. This constraint, when applied at the organization level, blocks all users from creating or uploading service account keys, ensuring that no long-lived credentials are generated for service accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
constraints/compute.restrictCloudArmorPolicies
Why it's wrong here
This restricts Cloud Armor policies.
- ✗
constraints/compute.requireShieldedVm
Why it's wrong here
This enforces Shielded VM on compute instances.
- ✗
constraints/iam.allowedPolicyMemberDomains
Why it's wrong here
This restricts which external domains can be members in IAM policies.
- ✓
constraints/iam.disableServiceAccountKeyCreation
Why this is correct
Correct: Prevents creation of service account keys.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.